Christopher Scott 


From: Christopher Scott 

Sent: Tuesday, August 2, 2016 3:34 PM 

To: Hawkins, E. A. (WF) (FBI) 

Cc: MSussmann@perkinscoie.com 

Subject: [Suspect] Re: [Suspect] Re: FBI and CrowdStrike Team 
Attachments: smime.p7s; ATT00001.txt; ATT00002.htm 


Agent Hawkins, 


| will wait for some scheduled time from Mr. Sussman. As we are working for them. | must have him 
involved in every conversation. 


Thanks 
Chris 


On Aug 2, 2016, at 11:44, Hawkins, E. A. (WF) (FBI) <Adrian.Hawkins@ic.fbi.gov> wrote: 


Any word on when we can have this call? | have several that would like to jump on. Also, DHS 
is ready to assist your victims and may be on the call. They will be interested on how best to 
plug into your gaps or create a synergistic composition of redundancy. 


- Original message -------- 

From: Christopher Scott <chris@crowdstrike.com> 

Date: 08/01/2016 1:54 PM (GMT-05:00) 

To: "Hawkins, E. A. (WF) (FBI)" <Adrian.Hawkins@ic.fbi.gov> 

Cc: "Lowder, Jason P. (CYD) (FBI)" <Jason.Lowder@ic.fbi.gov>, "Sussmann, Michael A. (Perkins 
Coie)" <MSussmann@perkinscoie.com> 

Subject: [Suspect] Re: FBI and CrowdStrike Team 


Adrian, 
We will schedule a call this week. We will need to coordinate schedules with Mr. Sussman, one 
of my analysts, and someone from the IT team for the DNC. That way we can cover all of this in 


one call. 


| am at Blackhat this week, but can break out for this when needed. 
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Michael, we should likely work around your schedule. 


Thanks 
Chris 


On Aug 1, 2016, at 10:22, Hawkins, E. A. (WF) (FBI) <Adrian.Hawkins@ic.fbi.gov> wrote: 


Mr. Scott, 


In addition to below, we are attempting to establish venue. What would help in 
regards to this is a statement of the location of all hacked servers. If there were a 
listing of compromised servers and their location, that'd be perfect. Else, if all 
examined systems were located in the DC office location, we can say that as well 
(for both DNC and DCCC). 


We need something factual and definate, please. Not general or ambiguous. 


-------- Original message -------- 

From: "Hawkins, E. A. (WF) (FBI)" <Adrian.Hawkins@ic.fbi.gov> 
Date: 07/30/2016 3:50 PM (GMT-05:00) 

To: Christopher Scott <chris@crowdstrike.com> 

Cc: “Lowder, Jason P. (CYD) (FBI)" <Jason.Lowder@ic.fbi.gov> 
Subject: Re: FBI and CrowdStrike Team 


Mr. Scott, 


https://www.washingtonpost.com/world/national-security/clinton-campaign- 


denies-reports-that-its-computer-system-was-hacked/2016/07/29/1c05afe2-55b9- 
11e6-88eb-7dda4e2f2aec_story.html? 


Are you guys aware of the DNC analytics program that was presumably hacked? 
We'll probably want to get more information regarding the specifics (name of the 
program, vulnerability that was targeted within the program, nature of the email 
address stored within the program -- since these are often used for additional 
targeting, etc). 
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| cc'd a Jason Lowder (CyD), since we're getting the question from our HQ 
managers. 


vir, 


Adrian 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


REDACTED 6674 


From: Christopher Scott <chris@crowdstrike.com> 

Sent: Wednesday, July 27, 2016 12:50 PM 

To: Robert Johnston; Hawkins, E. A. (WF) (FBI); Hubiak, Joshua J. (PH) (FBI); Mularski, J K. 
(PG) (FBI); Cotellesse, Gerald S. (PH) (FBI); Schorle, Christian J. (NK) (FBI) 

Subject: [Suspect] RE: FBl and CrowdStrike Team 


Great to meet all of you via email. | have been the Director overseeing this 
engagement with Robert. At your convenience, please send me your preferred 
contact information. 


Thanks, 


Chris 


Christopher Scott 
chris@crowdstrike.com 
Phone: EDEN 3824 


From: Robert Johnston 

Sent: Wednesday, July 27, 2016 10:10 AM 

To: Hawkins, E. A. (WF) (FBI) <Adrian.Hawkins@ic.fbi.gov>; Hubiak, Joshua J. (PH) 
(FBI) <Joshua.Hubiak@ic.fbi.gov>; Mularski, J K. (PG) (FBI) <J.Mularski@ic.fbi.gov>; 
Cotellesse, Gerald S. (PH) (FBI) <Gerald.Cotellesse(Wic.fbi.gov>; Schorle, Christian J. 
(NK) (FBI) <Christian.Schorle@ic.fbi.gov> 

Cc: Christopher Scott <chris@crowdstrike.com> 
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Subject: FBI and CrowdStrike Team 


All, 


| wanted to let you know that | will be transitioning from CrowdStrike and my duties 
will be passed to another highly capable member of our team. Chris Scott, our 
Director for Remediation will be taking over the engagement and will be your 
principal point of contact. His contact information is in the CC line as well as below. 


| thought it would be a good idea to connect all of you with him so when you guys 
here some valuable intel you can quickly get the information exchange up and 
running and get some execution as fast as possible. 


It has been a pleasure to work with you all. As a company we are dedicated to the 
mission ensuring the integrity of the US democratic establishment and take great 
pride in our work with you. | wish you the best and please let me know if there is 
anything you need from me. 


Chris Scott 


Email: chris@crowdstrike.com 


Phone: EDEN-3824 


Chris, 


In the To line is the team of FBI agents | have been working with throughout the 
engagement. They have passed some valuable information our way and have been 
an integrated part of our success. 


Best Regards, 
Robert S. Johnston 


CrowdsStrike, Inc 


SCC_0000346 


No. 1:21-cr-00582-CRC (D.D.C.) DX-118_0004 


SCC_0000347 


No. 1:21-cr-00582-CRC (D.D.C.) DX-118_0005 


